Overview | Package | Class | Tree | Deprecated | Index | Help
| Bouncy Castle Cryptography Library 1.85
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.bouncycastle.math.raw
Class GF16

    java.lang.Object
      org.bouncycastle.math.raw.GF16

public class GF16
extends java.lang.Object

Constructor Summary
`GF16()`

Method Summary
`static void` | `decode(byte[] input, byte[] output, int outputLen)` Decodes an encoded byte array.
`static void` | `decode(byte[] input, int inOff, byte[] output, int outOff, int outputLen)`
`static void` | `encode(byte[] input, byte[] output, int inputLen)` Encodes an array of 4-bit values into a byte array.
`static void` | `encode(byte[] input, byte[] output, int outOff, int inputLen)`
`static byte` | `innerProduct(byte[] a, int aOff, byte[] b, int bOff, int rank)`
`static byte` | `inv(byte a)` Multiplicative inverse in GF(16), table-free: a^14 = a^-1 (since a^15 = 1 for a !
`static int` | `inv(int a)` Multiplicative inverse in GF(16); table-free, branch-free (see `inv(byte)`).
`static byte` | `mul(byte a, byte b)` GF(16) multiplication mod x^4 + x + 1.
`static int` | `mul(int a, int b)` GF(16) multiplication mod x^4 + x + 1; table-free, branch-free (see `mul(byte, byte)`).
`static long` | `mulAddStep16(long v, long m0, long m1, long m2, long m3)` One step of the bitsliced, word-parallel GF(16) scalar-times-vector multiply-accumulate.
`static long` | `mulFx8(int a, long b)` Byte-lane parallel GF(16) multiply: multiplies the single GF(16) scalar into up to eight GF(16) elements packed one-per-byte in (each in the low nibble of its byte), all at once and table-free.
`static int` | `sqr(int a)` Constant-time GF(16) squaring over x^4 + x + 1.

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### GF16

    public GF16()

Method Detail

### mulAddStep16

    public static long mulAddStep16(long v,
                                    long m0,
                                    long m1,
                                    long m2,
                                    long m3)

  One step of the bitsliced, word-parallel GF(16) scalar-times-vector multiply-accumulate. Returns the contribution to XOR into the accumulator for a single 16-nibble packed input limb , given the four broadcast scalar-bit masks (each 0 or -1, one per bit of the GF(16) scalar). The caller hoists the mask computation outside its limb loop.

  This is the constant-time, table-free GF(16) kernel shared by UOV's and MAYO's : a mask-select on the scalar bits plus a SWAR multiply-by-x that folds x+1 (0x3) per nibble for the field polynomial x^4 + x + 1. No data-dependent branch and no secret-indexed table.

  Parameters:
    `v` - 16 GF(16) nibbles packed into a long.
    `m0` - broadcast mask (0 or -1) for scalar bit 0.
    `m1` - broadcast mask (0 or -1) for scalar bit 1.
    `m2` - broadcast mask (0 or -1) for scalar bit 2.
    `m3` - broadcast mask (0 or -1) for scalar bit 3.
  Returns:
    the multiply-accumulate contribution for this limb.

### mul

    public static byte mul(byte a,
                           byte b)

  GF(16) multiplication mod x^4 + x + 1.

  Table-free, branch-free carryless multiply followed by reduction modulo x^4 + x + 1, so the multiply carries no secret-indexed memory access (no L3 cache-timing side channel) — the form used by the SNOVA and MAYO reference implementations' production (Opt / AVX2) builds. Please ensure a <= 0x0F and b <= 0x0F.

  Parameters:
    `a` - an element in GF(16) (only the lower 4 bits are used)
    `b` - an element in GF(16) (only the lower 4 bits are used)
  Returns:
    the product a * b in GF(16)

### mul

    public static int mul(int a,
                          int b)

  GF(16) multiplication mod x^4 + x + 1; table-free, branch-free (see `mul(byte, byte)`). Please ensure a <= 0x0F and b <= 0x0F.

  Parameters:
    `a` - an element in GF(16) (only the lower 4 bits are used)
    `b` - an element in GF(16) (only the lower 4 bits are used)
  Returns:
    the product a * b in GF(16)

### mulFx8

    public static long mulFx8(int a,
                              long b)

  Byte-lane parallel GF(16) multiply: multiplies the single GF(16) scalar into up to eight GF(16) elements packed one-per-byte in (each in the low nibble of its byte), all at once and table-free. The batched, constant-time form of `mul(int, int)` used to multiply a scalar by a whole packed matrix row (the SNOVA / MAYO ).

  Parameters:
    `a` - a GF(16) scalar (only the lower 4 bits are used)
    `b` - up to eight GF(16) elements, one per byte lane
  Returns:
    the eight products, one per byte lane

### sqr

    public static int sqr(int a)

  Constant-time GF(16) squaring over x^4 + x + 1. Squaring is GF(2)-linear, so is just the bit-spread of (interleave a zero between each bit, via `Interleave.expand4to8(int)`) reduced mod 0x13. means the folded-down high nibble multiplies by 0x3, computed branchlessly as = ; one fold suffices here (unlike GF(256)) because 0x3 is degree 1. Returns the same value as `mul(a, a)` but with no per-term work — table-free, branchless, and faster (~1.35x on HotSpot C2), so it replaces the squarings in `inv(int)`.

### inv

    public static byte inv(byte a)

  Multiplicative inverse in GF(16), table-free: a^14 = a^-1 (since a^15 = 1 for a != 0; 0 maps to 0), so the inverse carries no secret-indexed memory access. Matches the SNOVA / MAYO reference / .

### inv

    public static int inv(int a)

  Multiplicative inverse in GF(16); table-free, branch-free (see `inv(byte)`). The three squarings go through `sqr(int)`; the two genuine products through `mul(int, int)`.

  Parameters:
    `a` - an element in GF(16) (only the lower 4 bits are used)
  Returns:
    the inverse a^-1 in GF(16), or 0 when

### decode

    public static void decode(byte[] input,
                              byte[] output,
                              int outputLen)

  Decodes an encoded byte array. Each byte in the input contains two nibbles (4-bit values); the lower nibble is stored first, followed by the upper nibble.

  Parameters:
    `input` - the input byte array (each byte holds two 4-bit values)
    `output` - the output array that will hold the decoded nibbles (one per byte)
    `outputLen` - the total number of nibbles to decode

### decode

    public static void decode(byte[] input,
                              int inOff,
                              byte[] output,
                              int outOff,
                              int outputLen)

### encode

    public static void encode(byte[] input,
                              byte[] output,
                              int inputLen)

  Encodes an array of 4-bit values into a byte array. Two 4-bit values are packed into one byte, with the first nibble stored in the lower 4 bits and the second nibble stored in the upper 4 bits.

  Parameters:
    `input` - the input array of 4-bit values (stored as bytes, only lower 4 bits used)
    `output` - the output byte array that will hold the encoded bytes
    `inputLen` - the number of nibbles in the input array

### encode

    public static void encode(byte[] input,
                              byte[] output,
                              int outOff,
                              int inputLen)

### innerProduct

    public static byte innerProduct(byte[] a,
                                    int aOff,
                                    byte[] b,
                                    int bOff,
                                    int rank)

Overview | Package | Class | Tree | Deprecated | Index | Help
| Bouncy Castle Cryptography Library 1.85
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD